Children’s personal data
As noted elsewhere (see GDPR details for researchers), it is recommended that the GDPR lawful basis for processing personal data in research should, wherever possible, be Public Task, or in some limited cases Legitimate Interest.
However, if for a specific reason you are in the unusual position of processing data under the GDPR lawful basis of Consent for a paediatric study, the DPA states that individuals aged 13 or over are capable of giving their own consent - unless there is a specific reason why this isn’t the case, for instance a condition or impairment.
Therefore, anyone aged 13 or over must provide their own consent to data processing. This is distinct from the processes for research Consent – if, as would always be the case for patients under 16 participating in Clinical Trials of Investigational Medicinal Products, a parent gives Consent for the research itself, the child should give separate Consent to the data processing to ensure compliance with GDPR.
For anyone aged under 13 their parent or guardian must provide Consent for data processing on their behalf.
